How the Legitimate Interest GDPR Test Works Under Article 6(1)(f)

What does legitimate interest mean under the GDPR?

Article 6(1)(f) is the legitimate interest GDPR basis: it lets a controller process personal data without asking for consent, provided the processing is necessary for an interest the controller or a third party pursues and the person's own rights do not outweigh that interest. It is one of six legal bases in Article 6(1), and it is the only one that makes the controller weigh its own interest against the person's. The full text, from the Official Journal version on EUR-Lex, reads:

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

A second sentence follows directly under the list of bases: "Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks."

Read the structure of point (f) closely. The interest is the starting point, "necessary" is a condition, and the exception, "except where such interests are overridden", is where the weighing happens. The article never lists which interests qualify. If you are still choosing between bases, the overview of the six GDPR legal bases sets point (f) beside consent, contract and the others.

What does Recital 47 add to Article 6(1)(f)?

Recital 47 adds the idea of reasonable expectations, and it gives examples of interests that count. Recitals are not binding on their own, but they explain how the articles are read, and the EDPB cites Recital 47 when it applies Article 6(1)(f). Recital 47 opens:

The legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller.

It then names a client or employee relationship as a setting where "such legitimate interest could exist", and warns that "the interests and fundamental rights of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect further processing."

Two examples close the recital, and they are worded differently for a reason. Fraud prevention is stated firmly: "The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned." Direct marketing is not: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." "May be regarded" is permission to argue the point. It does not settle it. Recital 49 adds network and information security, again limited to what is "strictly necessary and proportionate".

What is the three-part test for legitimate interest?

The three-part test is the EDPB's method for checking Article 6(1)(f), and all three parts must pass. The European Data Protection Board set it out in Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR, version 1.0, adopted on 8 October 2024 and opened for public feedback from 9 October to 20 November 2024. The EDPB's page for the guidelines still lists version 1.0, the consultation text. In the board's words:

For processing to be based on Article 6(1)(f) GDPR, three cumulative conditions must be fulfilled: First, the pursuit of a legitimate interest by the controller or by a third party; Second, the need to process personal data for the purposes of the legitimate interest(s) pursued; and Third, the interests or fundamental freedoms and rights of the concerned data subjects do not take precedence over the legitimate interest(s) of the controller or of a third party.

Step	Question	What the EDPB requires
1. Legitimate interest	Is the interest acceptable at all?	"lawful", "clearly and precisely articulated", and "real and present, and not speculative" (paragraph 17)
2. Necessity	Is processing personal data needed for it?	The interest "cannot reasonably be achieved just as effectively by other means less restrictive" of the person's rights
3. Balancing	Do the person's rights win?	Weigh impact, nature of the data, context and "reasonable expectations", plus any safeguards

The necessity step is a hard filter. If a less intrusive route reaches the same goal, the executive summary of the EDPB guidelines says plainly that "the processing may not be based on Article 6(1)(f) GDPR." Aggregated counts instead of per-person records, or a truncated IP address instead of a full one, are the kind of alternatives that step asks about.

The EDPB also rejects two opposite habits. Paragraph 9 says Article 6(1)(f) "cannot be considered as a legal basis 'by default'" and should not be seen as an "open door" to legitimise processing that fits no other basis. The same paragraph says it is not a "last resort" either. On timing, paragraph 12 says the assessment "should be made at the outset of the processing, with the involvement of the Data Protection Officer (DPO) (if designated), and should be documented by the controller in line with the accountability principle set out in Article 5(2) GDPR." A test written up after launch fails that requirement.

Three gates in sequence

Legitimate interest identified

Necessity confirmed

Balancing test passed

Article 6(1)(f) applies

What rights does a person keep under legitimate interest?

A person keeps the right to object, and consent-based processing has no equivalent of it. Article 21(1) GDPR reads:

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

The bar after an objection is "compelling legitimate grounds", which is higher than the ordinary balancing test. For direct marketing, Article 21(2) and 21(3) remove the balancing entirely: once the person objects, "the personal data shall no longer be processed for such purposes." Article 21(4) requires that the right be brought to the person's attention "clearly and separately from any other information", and the EDPB adds that the controller must tell people which legitimate interests it pursues.

Does ePrivacy Article 5(3) apply separately from the GDPR?

Yes. ePrivacy Article 5(3) governs storing or reading information on a user's device, and it applies on top of the GDPR, not instead of it. The consolidated text of Directive 2002/58/EC on EUR-Lex reads:

Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.

Article 5(3) contains no legitimate interest ground. Its default is consent, and it has two exemptions: transmission, and "strictly necessary" for a service the user "explicitly requested". The Court of Justice held in Planet49 (C-673/17, 1 October 2019) that this protection "applies to any information stored in such terminal equipment, regardless of whether or not it is personal data", a passage the EDPB quotes in its Guidelines 2/2023 on the technical scope of Article 5(3). Guidelines 1/2024 say at paragraph 11 that they are "without prejudice to" the ePrivacy Directive. So a controller that sets a non-exempt cookie needs consent for the cookie under Article 5(3), whatever Article 6 basis it picks for the data that follows.

Can website analytics rely on legitimate interest?

Whether website analytics can rely on legitimate interest is unsettled, and the answer depends on which of two layers you mean. The device layer is Article 5(3). The processing layer is Article 6. A tool has to clear both.

On the device layer, the EDPB reads Article 5(3) broadly. Guidelines 2/2023, version 2.0 adopted on 7 October 2024, say at paragraph 51 that when a tracking pixel is built by "client-side applicative logic (usually a JavaScript code)", collecting the identifiers "constitutes a 'gaining of access'". National regulators have gone further in the other direction. France's CNIL states that "subject to a number of conditions, cookies used for audience measurement are exempt from consent", including limiting the purpose to audience measurement, truncating "the last byte of the IP address", and capping tracker lifetime at 13 months. The UK wrote an opt-out exemption into law: Schedule 12 of the Data (Use and Access) Act 2025, in force since 5 February 2026, lets a service store or access information "for statistical purposes about how the service is used with a view to making improvements to the service" if users get clear information and "a simple means of objecting". The UK is outside the EU, and Article 5(3) itself contains no such text.

On the processing layer, the EDPB is sceptical where tracking is involved. Discussing direct marketing, paragraph 115 of Guidelines 1/2024 says that where Article 5(3) consent is needed, consent "will likely constitute the appropriate legal basis both for storing and gaining access to information already stored on the user's device and for the subsequent processing of personal data", "thus normally precluding reliance on Article 6(1)(f) in this context." Paragraph 120 says the balancing test "would hardly yield" a positive result for "intrusive profiling and tracking practices for marketing purposes, for example those that involve tracking individuals across multiple websites, locations, devices or services."

Setup	Device layer (Article 5(3))	Processing layer (Article 6)
Cross-site tracking and ad profiling	Consent	EDPB: balancing "would hardly yield" a pass
First-party audience cookies, CNIL conditions met	CNIL: exempt; Article 5(3) text: no analytics exemption	Legitimate interest argued, test still required
No storage or access on the device, personal data processed	Not triggered	Legitimate interest possible with a documented test
No personal data processed	Depends on device access	GDPR does not apply

One point holds on every side: the fewer identifiers a tool handles, the easier every step of the test becomes, and the question of whether analytics needs consent at all turns first on what the script does on the device. A cookie banner answers the Article 5(3) question. It does not answer the Article 6 one. Whether a truncated IP or a hashed identifier still counts as personal data is its own question, covered in the piece on what counts as PII.

Frequently asked questions

Is legitimate interest easier than consent?

No, in the EDPB's reading. Guidelines 1/2024 say Article 6(1)(f) should not be chosen "on the basis of a perception that Article 6(1)(f) GDPR is less constraining than other legal bases." Consent needs a valid opt-in. Legitimate interest needs a documented three-part assessment made before processing and an honoured right to object.

Does a legitimate interest assessment have to be written down?

The EDPB says it should be documented, citing the accountability principle in Article 5(2) GDPR. Article 5(2) says the controller "shall be responsible for, and be able to demonstrate compliance with" the principles, and an unwritten balancing test is hard to demonstrate.

Can a public authority use legitimate interest?

Not for its official tasks. Article 6(1) states that point (f) "shall not apply to processing carried out by public authorities in the performance of their tasks." Those authorities rely on Article 6(1)(e), processing in the public interest, which needs a basis in Union or Member State law.

Is direct marketing always a legitimate interest?

No. Recital 47 says direct marketing "may be regarded as carried out for a legitimate interest", which leaves the three-part test in place. Email and SMS marketing also fall under Article 13 of the ePrivacy Directive, which the EDPB reads as requiring prior consent outside the existing-customer exception.

Can legitimate interest replace consent for cookies?

No. ePrivacy Article 5(3) sets its own consent rule for storing or reading information on a device, with only the transmission and strictly necessary exemptions. A GDPR legal basis under Article 6 covers the processing of personal data afterwards and does not stand in for Article 5(3) consent.

Are the EDPB legitimate interest guidelines final?

The published text is version 1.0, adopted on 8 October 2024 and put to public consultation until 20 November 2024. The EDPB page for Guidelines 1/2024 still lists version 1.0. Check that page before citing the guidelines in a formal assessment, since a revised version would replace it.

What examples does the GDPR give of legitimate interest?

Recital 47 names a client or employee relationship as a setting where legitimate interest could exist, and Recital 49 adds network and information security, limited to what is strictly necessary and proportionate. Fraud prevention gets the firmest wording: Recital 47 states it "also constitutes a legitimate interest," full stop. Direct marketing gets weaker wording, only that it "may be regarded" as a legitimate interest, which leaves the three-part test to decide each case.

Can I object to processing based on legitimate interest?

Article 21(1) gives a person the right to object at any time to processing based on Article 6(1)(f), and the controller has to stop unless it demonstrates "compelling legitimate grounds" that override the person's rights, a higher bar than the ordinary balancing test. For direct marketing specifically, Article 21(2) and 21(3) remove that balancing entirely: once the person objects, the data can no longer be processed for that purpose. Article 21(4) requires the controller to flag this right clearly and separately from other information.

Can legitimate interest be used when no other legal basis fits?

Paragraph 9 of the EDPB's Guidelines 1/2024 rules that out directly: Article 6(1)(f) "cannot be considered as a legal basis 'by default'" and is not an "open door" for processing that fits no other basis. The same paragraph rejects the opposite habit too, treating it as a "last resort." Each use still needs its own documented three-part test.

Are audience-measurement cookies exempt from consent?

Article 5(3) itself contains no analytics exemption, but France's CNIL allows one under conditions: the purpose stays limited to audience measurement, the last byte of the IP address gets truncated, and tracker lifetime is capped at 13 months. The UK took a different route, writing an opt-out exemption into Schedule 12 of the Data (Use and Access) Act 2025, which lets a service store or access statistical usage information if people get clear information and a simple way to object. That UK exemption sits outside EU law, since the UK is no longer part of it.